kreftjs 0.0.2-beta → 0.0.3-beta

package/README.md

@@ -75,12 +75,12 @@ Views are escaped, logins use HttpOnly cookies with CSRF protection, passwords u
 
 ## Migrating from Som.js
 
-Kreft is Som.js under a new name: the package is `kreftjs` (version 0.0.2-beta), the command is `kreftjs`, the global is `Kreftjs` and component files end in `.kreftjs`. The old names keep working, so an existing project runs without edits. New files and everything the tools write use the new names. Move over when it suits you. (`kreft` was an earlier spelling of the new name; it is accepted in the same places.)
+Kreft is Som.js under a new name: the package is `kreftjs` (version 0.0.3-beta), the command is `kreftjs`, the global is `Kreftjs` and component files end in `.kreftjs`. The old names keep working, so an existing project runs without edits. New files and everything the tools write use the new names. Move over when it suits you. (`kreft` was an earlier spelling of the new name; it is accepted in the same places.)
 
 | Som.js | Kreft | Still works? |
 |---|---|---|
-| `npm i -g somjs` | `npm i -g kreftjs` | The `som` and `kreft` commands stay as other names for `kreftjs`. `som` prints a one-line notice. |
-| `som dev`, `som build`, `som make:page` … | `kreftjs dev`, `kreftjs build`, `kreftjs make:page` … | Yes, through the `som` command. |
+| `npm i -g somjs` | `npm i -g kreftjs` | `kreft` is another name for `kreftjs`. Kreft does not install a `som` command, so it does not clash with an old Som.js (remove that with `npm rm -g somjs`). |
+| `som dev`, `som build`, `som make:page` … | `kreftjs dev`, `kreftjs build`, `kreftjs make:page` … | Replace `som` with `kreftjs`. |
 | `Counter.som` (and `Counter.kreft`) | `Counter.kreftjs` | Yes. All three extensions compile; a name that is missing with one extension is tried with the others (`layouts/app.kreftjs` finds `layouts/app.som`). |
 | `s-if`, `s-each`, `s-model` … (every `s-` directive) | `k-if`, `k-each`, `k-model` … | Yes. Both prefixes are read in templates. |
 | `<som-view>`, `<som-link>`, `<som-wait>`, `<som-component>`, `<som-yield>`, `<som-section>`, `<som-portal>` | `<kreft-view>`, `<kreft-link>` … | Yes. Both tag names work. |

package/bin/add.js

@@ -43,7 +43,7 @@ const fs = require('fs');
 const path = require('path');
 const https = require('https');
 const readline = require('readline');
-const { spawnSync } = require('child_process');
+const { runSync } = require('./win-spawn.js');
 const { layout } = require('./layout.js');
 const pkg = require('../package.json');
 
@@ -449,7 +449,7 @@ module.exports = async function add(args = []) {
   installArgs.push(...targets);
 
   console.log(`  ${cyan('Executing:')} npm ${installArgs.join(' ')}\n`);
-  const res = spawnSync(npmCmd, installArgs, { stdio: 'inherit', cwd: project });
+  const res = runSync(npmCmd, installArgs, { stdio: 'inherit', cwd: project });
 
   if (res.status !== 0) {
     console.error(`\n  ${red('✖ Failed to install packages.')}`);
@@ -739,7 +739,7 @@ function getInstalledPackageJson(projectDir, pkgName) {
 
 function getAuditReport(npmCmd, projectDir) {
   try {
-    const res = spawnSync(npmCmd, ['audit', '--json'], { cwd: projectDir, encoding: 'utf8' });
+    const res = runSync(npmCmd, ['audit', '--json'], { cwd: projectDir, encoding: 'utf8' });
     if (res.stdout) {
       return JSON.parse(res.stdout);
     }

package/bin/electron.js

@@ -11,7 +11,7 @@
  */
 const fs = require('fs');
 const path = require('path');
-const { spawn } = require('child_process');
+const { start: spawn } = require('./win-spawn.js');
 
 function getProjectRoot(start = process.cwd()) {
   const lay = require('./layout.js').layout(start);

package/bin/kreftjs.js

@@ -35,10 +35,6 @@ if (require.main === module && (process.argv.includes('--gc') || process.env.AUT
 }
 
 const rawArgs = process.argv.slice(2).filter((a) => a !== '--gc');
-// `som` (and `somjs`) still run this file, so an existing global install keeps working
-if (require.main === module && /^(som|somjs)(\.cmd|\.js)?$/i.test(path.basename(process.argv[1] || ''))) {
-  console.error('  The "som" command is now "kreftjs" (Som.js is now Kreft). "som" still works for now: use "kreftjs" from here on.');
-}
 const [command = 'help', ...rest] = rawArgs;
 
 const commands = {

package/bin/update.js

@@ -12,7 +12,7 @@
  */
 const fs = require('fs');
 const path = require('path');
-const { spawnSync } = require('child_process');
+const { runSync } = require('./win-spawn.js');
 const { layout } = require('./layout.js');
 const pkg = require('../package.json');
 
@@ -180,7 +180,7 @@ function updateNpmPackages(project, pkgs, flags) {
 
   if (flags.has('check')) {
     console.log(`  ${cyan('Checking for outdated packages (npm outdated):')}\n`);
-    const res = spawnSync(npmCmd, ['outdated'], { stdio: 'inherit', cwd: project });
+    const res = runSync(npmCmd, ['outdated'], { stdio: 'inherit', cwd: project });
     if (res.status === 0) {
       console.log(`  ${green('All packages are up to date.')}`);
     }
@@ -210,7 +210,7 @@ function updateNpmPackages(project, pkgs, flags) {
   }
 
   console.log(`  ${dim('$ ' + npmCmd + ' ' + cmdArgs.join(' '))}\n`);
-  const result = spawnSync(npmCmd, cmdArgs, { stdio: 'inherit', cwd: project });
+  const result = runSync(npmCmd, cmdArgs, { stdio: 'inherit', cwd: project });
 
   if (result.error) {
     console.error(`  ${red('Error running npm:')} ${result.error.message}`);

package/bin/win-spawn.js

@@ -0,0 +1,39 @@
+/*
+ * Starting npm and other .cmd programs on Windows.
+ *
+ * Since Node.js 20.12 (and 22) a .cmd or .bat file can only be started through a shell: spawn('npm.cmd') alone fails with
+ * "spawnSync npm.cmd EINVAL". These helpers do that on Windows and start the program directly everywhere else.
+ * With a shell, an argument could carry a second command (`pkg & calc`), so characters that mean something to cmd.exe are refused.
+ */
+const { spawn, spawnSync } = require('child_process');
+
+const WIN = () => process.platform === 'win32';
+const UNSAFE = /[;&|`$<>%!"\r\n]/;
+const quote = (a) => (/[\s^()]/.test(a) ? `"${a}"` : a);
+const isCmdFile = (f) => /\.(cmd|bat)$/i.test(f);
+
+function prepare(cmd, args, options) {
+  if (!WIN() || !isCmdFile(cmd) && cmd !== 'npm' && cmd !== 'npx') return { cmd, args, options };
+  const list = args.map(String);
+  const bad = list.find((a) => UNSAFE.test(a));
+  if (bad) throw new Error(`The argument ${JSON.stringify(bad)} has a character that is not allowed here.`);
+  return { cmd: quote(cmd), args: list.map(quote), options: { ...options, shell: true } };
+}
+
+// spawnSync that works for npm on Windows; an unsafe argument comes back as { status: 1, error }
+function runSync(cmd, args = [], options = {}) {
+  try {
+    const p = prepare(cmd, args, options);
+    return spawnSync(p.cmd, p.args, p.options);
+  } catch (error) {
+    return { status: 1, error };
+  }
+}
+
+// spawn that works for .cmd programs (electron-builder.cmd …) on Windows
+function start(cmd, args = [], options = {}) {
+  const p = prepare(cmd, args, options);
+  return spawn(p.cmd, p.args, p.options);
+}
+
+module.exports = { runSync, start, isCmdFile, prepare };

package/docs/README.md

@@ -82,7 +82,7 @@ npx kreftjs dev
 ### Check that it works
 
 ```bash
-kreftjs --version     # for example 0.0.2-beta
+kreftjs --version     # for example 0.0.3-beta
 kreftjs about         # Kreft and Node.js versions, this project's settings and drivers
 kreftjs list          # every command your version has
 ```
@@ -138,7 +138,7 @@ Kreft is Som.js under a new name (the package and command are `kreftjs`), and an
 - **Files:** `.som` (and `.kreft`) files still compile, next to `.kreftjs` ones. A name that is missing with one extension is tried with the others. Everything the tools write is `.kreftjs`.
 - **Templates:** `s-if`, `s-each` and every other `s-` directive are read as `k-if`, `k-each` …, and `<som-view>`, `<som-link>` … as `<kreft-view>`, `<kreft-link>` …
 - **JavaScript:** `Som` and `Kreft` are other names for `Kreftjs` (same object; `Som` is deprecated), and `Som.compileSom` is `Kreftjs.compile`.
-- **Command:** `som` and `kreft` still run `kreftjs`; `som` prints a one-line notice.
+- **Command:** use `kreftjs` (or `kreft`). Kreft does not install a `som` command, so it can be installed next to an old Som.js without an `EEXIST` error; remove the old one with `npm rm -g somjs`.
 - **Server code:** `require('somjs/server')` (also `som/server`, `@somjs/server`, `kreft/server`) still works; new code uses `require('kreftjs/server')`.
 - **Settings:** `kreft.config.json`, `som.config.json` and `SOM_` environment variables (`SOM_SSR`, `SOM_ALLOWED_HOSTS` …) are read when the `kreftjs.config.json` file or the `KREFT_` variable is missing.
 - **Cookies:** new projects use `kreft_session`, `kreft_2fa` and `kreft_bypass`. An existing project keeps its `som_` names until you change `app/Auth/Session.js`, and the framework's CSRF check accepts both.

package/kreftjs.d.ts

@@ -1,4 +1,4 @@
-// Type definitions for Kreft 0.0.2-beta
+// Type definitions for Kreft 0.0.3-beta
 // Use from TypeScript or for editor hints in plain JavaScript (// @ts-check).
 
 export interface Signal<T> { value: T }

package/kreftjs.js

@@ -1,5 +1,5 @@
 /*!
- * Kreft v0.0.2-beta — reactive by nature
+ * Kreft v0.0.3-beta — reactive by nature
  * The .kreftjs component language (state · derive · action · when · watch · on),
  * { } views with k-if / k-each / k-model, components, slots, router, stores,
  * share / receive, event bus and a template engine.
@@ -5032,7 +5032,7 @@
     stores, storeLog, busLog,
   };
 
-  const VERSION = '0.0.2-beta';
+  const VERSION = '0.0.3-beta';
   const Kreftjs = {
     version: VERSION,
     // PUBLIC_ values from .env (kreftjs dev and kreftjs build put them here); never secrets

package/package.json

@@ -1,20 +1,19 @@
 {
   "name": "kreftjs",
-  "version": "0.0.2-beta",
+  "version": "0.0.3-beta",
   "description": "A tiny reactive framework with its own component language (.kreftjs files): router with nested routes, stores, saved data, animations, an API client, hot reload, DevTools and a template engine.",
   "main": "kreftjs.js",
   "browser": "kreftjs.js",
   "bin": {
     "kreftjs": "bin/kreftjs.js",
-    "kreft": "bin/kreftjs.js",
-    "som": "bin/kreftjs.js"
+    "kreft": "bin/kreftjs.js"
   },
   "scripts": {
     "dev": "node bin/kreftjs.js dev --api demo/db.json --db sqlite:demo/database/demo.db --migrations demo/database/migrations --server demo/server --backend demo --seed",
     "start": "node bin/kreftjs.js dev --api demo/db.json --db sqlite:demo/database/demo.db --migrations demo/database/migrations --server demo/server --backend demo --seed",
     "build": "node bin/kreftjs.js build demo --out dist/demo --include docs",
     "preview": "node bin/kreftjs.js dev dist --api demo/db.json --db sqlite:demo/database/demo.db --migrations demo/database/migrations --server demo/server --backend demo --seed",
-    "test": "node --test test/security.test.js test/prerender.test.js test/seo.test.js test/rebrand.test.js test/noauth.test.js",
+    "test": "node --test test/security.test.js test/prerender.test.js test/seo.test.js test/rebrand.test.js test/noauth.test.js test/winspawn.test.js",
     "electron": "kreftjs electron",
     "electron:dev": "kreftjs electron:dev",
     "electron:build": "kreftjs electron:build"

package/templates/app/frontend/errors/ErrorMonitor.kreftjs

@@ -90,7 +90,7 @@ action copyReport() {
         <div class="badges">
           <span class="badge danger-badge">HTTP {status}</span>
           <span class="badge solid">{currentTitle}</span>
-          <span class="badge">Kreft {Kreftjs.version || '0.0.2-beta'}</span>
+          <span class="badge">Kreft {Kreftjs.version || '0.0.3-beta'}</span>
         </div>
         <div class="actions">
           <button class="sm" @click={copyReport}>{copied ? 'Copied Markdown' : 'Copy Report'}</button>
@@ -187,7 +187,7 @@ action copyReport() {
         <h3>Kreft Runtime</h3>
         <table>
           <tbody>
-            <tr><th>Engine</th><td><code>Kreft v{Kreftjs.version || '0.0.2-beta'}</code></td></tr>
+            <tr><th>Engine</th><td><code>Kreft v{Kreftjs.version || '0.0.3-beta'}</code></td></tr>
             <tr><th>Sanitizer</th><td><code>Active (cleanHtml / SafeHtml)</code></td></tr>
             <tr><th>Environment</th><td><code>development (APP_DEBUG=true)</code></td></tr>
           </tbody>

package/templates/app/frontend/kreftjs.d.ts

@@ -1,4 +1,4 @@
-// Type definitions for Kreft 0.0.2-beta
+// Type definitions for Kreft 0.0.3-beta
 // Use from TypeScript or for editor hints in plain JavaScript (// @ts-check).
 
 export interface Signal<T> { value: T }

package/templates/app/frontend/kreftjs.js

@@ -1,5 +1,5 @@
 /*!
- * Kreft v0.0.2-beta — reactive by nature
+ * Kreft v0.0.3-beta — reactive by nature
  * The .kreftjs component language (state · derive · action · when · watch · on),
  * { } views with k-if / k-each / k-model, components, slots, router, stores,
  * share / receive, event bus and a template engine.
@@ -5032,7 +5032,7 @@
     stores, storeLog, busLog,
   };
 
-  const VERSION = '0.0.2-beta';
+  const VERSION = '0.0.3-beta';
   const Kreftjs = {
     version: VERSION,
     // PUBLIC_ values from .env (kreftjs dev and kreftjs build put them here); never secrets

package/templates/app/frontend/pages/Dashboard.kreftjs

@@ -110,7 +110,7 @@ load board = api.get('/api/dashboard')
         <div class="info-list">
           <div class="info-item">
             <span class="info-label">Framework Engine</span>
-            <span class="info-value">Kreft {Kreftjs.version || '0.0.2-beta'}</span>
+            <span class="info-value">Kreft {Kreftjs.version || '0.0.3-beta'}</span>
           </div>
           <div class="info-item">
             <span class="info-label">Active Database</span>

package/templates/errors/ErrorMonitor.kreftjs

@@ -116,7 +116,7 @@ action copyReport() {
         <div class="hero-badges">
           <span class="badge-exception">{currentTitle}</span>
           <span class="badge-env">Node.js {typeof process !== 'undefined' ? process.version : 'v22.0.0'}</span>
-          <span class="badge-env">Kreft v0.0.2-beta</span>
+          <span class="badge-env">Kreft v0.0.3-beta</span>
         </div>
         <h1 class="hero-error-message">{currentMessage}</h1>
       </div>